Josef Bacik e2d2afe15e bpf: fix states equal logic for varlen access ... If we have a branch that looks something like this int foo = map->value; if (condition) { foo += blah; } else { foo = bar; } map->array[foo] = baz; We will incorrectly assume that the !condition branch is equal to the condition branch as the register for foo will be UNKNOWN_VALUE in both cases. We need to adjust this logic to only do this if we didn't do a varlen access after we processed the !condition branch, otherwise we have different ranges and need to check the other branch as well. Fixes: 484611357c ("bpf: allow access into map value arrays") Reported-by: Jann Horn <jannh@google.com> Signed-off-by: Josef Bacik <jbacik@fb.com> Acked-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: David S. Miller <davem@davemloft.net>		2016-11-30 14:50:52 -05:00
..
arraymap.c	bpf: Add bpf_current_task_under_cgroup helper	2016-08-12 21:49:41 -07:00
core.c	bpf: clean up put_cpu_var usage	2016-09-27 22:09:17 -04:00
hashtab.c	bpf: fix htab map destruction when extra reserve is in use	2016-11-07 13:20:52 -05:00
helpers.c	bpf: direct packet write and access for helpers for clsact progs	2016-09-20 23:32:11 -04:00
inode.c	fs: Replace CURRENT_TIME with current_time() for inode timestamps	2016-09-27 21:06:21 -04:00
Makefile	bpf: introduce percpu_freelist	2016-03-08 15:28:31 -05:00
percpu_freelist.c	bpf: introduce percpu_freelist	2016-03-08 15:28:31 -05:00
percpu_freelist.h	bpf: introduce percpu_freelist	2016-03-08 15:28:31 -05:00
stackmap.c	bpf: add BPF_CALL_x macros for declaring helpers	2016-09-09 19:36:04 -07:00
syscall.c	bpf: fix map not being uncharged during map creation failure	2016-11-07 13:22:26 -05:00
verifier.c	bpf: fix states equal logic for varlen access	2016-11-30 14:50:52 -05:00